EP1924072A1 - Connection setup in a private IP network without contacting a public STUN server - Google Patents

Abstract

The method involves sending a test data packet to terminals (E2, E3) by another terminal (E1), and receiving a route of the test data packet in data networks such as local area network (LAN) and Internet (WWW). A checking is made whether the terminals (E2, E3) are arranged in an address space, based on the received route. A local address of the terminal (E1) is used as a sender address for setting up a communication connection, if the result of the checking is positive. A global address of the terminal is used as the sender address, if the result of the checking is not positive. An independent claim is also included for a terminal for setting up a packet oriented communication connection from the terminal to another terminal in a data network.

Description

The invention relates to a method for setting up a packet-oriented communication connection according to the preamble of patent claim 1 and to a terminal for setting up a packet-oriented communication connection in a data network according to patent claim 7.

Data networks are used not only for the transmission of electronic messages (e.g., e-mails), the transmission of Internet pages and other so-called "offline" content, but also for real-time communication links. The latter communication links mostly consist of data streams ("media streams"), which consist of a series of data packets, which are usually transmitted by means of the Internet protocol between terminals, servers or other network elements. A well-known example of such data stream-oriented communication links are Internet telephone calls, the so-called VoIP connections (VoIP = Voice Over Internet Protocol). In this case, the useful contents (for example digitized audio signals, moving images, etc.) are inserted in data packets (IP datagrams), provided with a communication address (IP address) of the receiver device and then by means of a local area network (LAN). or with a public data network (usually the Internet).

Commonly used communication protocols such as ITU-TH.323 or SIP (Session Initiation Protocol) are used for the construction and operation of such a packet-oriented communication connection. In this case, between a terminal establishing the communication connection and the called remote site (either another terminal or a network component, such as gateway, gatekeeper, server etc.) according to protocol signaling messages exchanged, which prepare the subsequent exchange of the actual payload data (payload streams). Such a signaling message is referred to, for example, in the environment of the SIP protocol as an "Invite" message, that is, as an "invitation message". Such a message includes in addition to the communication address (here: IP address) of the called terminal and a "sender address", ie the IP address of the calling terminal. The "sender address" is used both for addressing the signaling messages in the reverse direction, ie from the called terminal to the calling terminal, as well as for addressing all payload packets that are to be transmitted from the called terminal to the calling terminal.

In the cases where both the called terminal and the called terminal are both located on the same local data network or both are on the same global data network (eg the Internet), both terminals belong to the same address space. In these cases, for each of the called terminal as well as for the calling terminal for the purposes of establishing the communication link that IP address can be used, which is permanently assigned to this terminal. Terminals that are arranged in local data networks (eg company intranets, home networks, etc.) are usually not equipped with a globally valid Internet address (IP address). One reason for this is that the address space of the currently used version of the Internet Protocol ("IPv4") consists of only four bytes, with the result that the address space formed therewith (address supply) is insufficient to all computers and Network elements worldwide with their own, unique IP address equip. For this reason, devices of private communication networks or data networks are addressed with IP addresses, which are only locally unique. Such private networks are connected to the public, global Internet with special network elements (routers, gateways). These network elements (gateway, router) are in turn with one or equipped with several globally valid and unique IP addresses, with the help of which they can be addressed from the Internet. Data packets that are transmitted from a local area network with local addresses via such a network element to a device on the Internet are converted in this network element with respect to the sender address. Such a method is the known NAT method (NAT = Network Address Translation), which replaces the locally valid sender address in the affected data packets by a globally valid Internet address and the incoming in the opposite direction from the Internet data packets with the local IP Address of the affected computer or terminal addressed and thus forwarded to the correct local endpoint.

The described NAT method works simply and securely for such data packets in which the sender address is entered only in the so-called "header" of the IP data packets and therefore only has to be exchanged in the header of the NAT instance. In many communication protocols, such as the already mentioned SIP protocol, the sender addresses are also coded in the so-called "higher protocol layers", which means that address information is also contained in the payload of the data packets, ie outside the "header" must be processed by the NAT process. However, this means that the NAT instance used in each case must "know" the structure of the useful content of the data packets of the most diverse communication protocols, which leads to the NAT instance having to be very complicated. Such a method is thus complicated and thus maintenance-intensive and not reliable in every case.

A solution to this problem is the use of the so-called STUN server (Simple Traversal of UDP Messages over NAT). STUN servers are usually located outside the local data networks, for example, directly connected to the Internet and are often provided by Internet providers. A calling terminal, which is located for example in a local data network, can by a Query message to the STUN server, the global Internet address (IP address) assigned to this terminal. When using a NAT instance, the address thus determined is often the IP address that would be used by the NAT entity in the query message data packet instead of the calling party's local IP address. The thus-obtained IP address can then be used by the calling terminal in the already mentioned "higher protocol layers" of the communication protocol used as a "sender address", so that a communication with a called terminal is easily possible even if this called terminal is arranged outside of its own local network.

A problem with the described method is that in particular larger private data networks, although having a uniform "private" address space, but may consist of a variety of domains and sub-networks, so that a calling terminal in contacting a called terminal based on the IP Address of the called terminal can not distinguish whether this called terminal is part of its own private data network, so its own address space, or not. For this reason, the described method, which involves the contacting of the STUN server, is frequently made for all communication connections, although in many cases this is not necessary at all. Thus, many communication links are unnecessarily routed over the Internet, although in fact it is a communication link that could be fully handled in its own private network. In addition to an unnecessary allocation of resources, this also means an increased security risk, because it can be assumed that the data packets routed via the Internet can be more easily "tapped" or manipulated than data packets transported "internally" in a private data network.

It is therefore an object of the present invention to optimize communication links of local terminals to other terminals.

The solution to this problem is specified in the independent claims.

The solution provides a method for establishing a packet-oriented communication connection from a first to a second terminal in a data network, wherein the data network consists of a local data network with local addresses of a local address space and an associated public data network with global addresses, the first Terminal is arranged in the local data network, and wherein the first terminal is associated with a local address for communication links within the local data network and a global address for communication links with terminals of the public data network. In this case, in a first step, a test data packet is sent to the second terminal by the first terminal, the route of the test data packet being detected in the data network; in a second step, the first and second terminal are checked on the basis of the detected route are arranged in the same local address space, and in a third step, in cases where the result of the check is positive, the local address of the first terminal is used as the sender address for establishing the communication connection, and the global address in the other cases. As a result, communication links between terminals of a local address space are not routed unnecessarily over a public network, thereby saving resources, reducing costs and increasing data security. In this case, network elements such as routers and NAT instances need not be reprogrammed, so that the method can be used in common infrastructures.

The solution also provides a terminal for establishing a packet-oriented communication connection in a data network before, with a device for sending a test data packet to a second terminal, with a means for detecting the passing of the test data packet route in the data network, with a means for evaluating the detected route, which can be determined by these means, whether the second terminal is arranged in the same address space as the first terminal, with a means for detecting a global address associated with the first terminal, and with a device for establishing the communication connection to the second terminal, this device being designed such that in the cases in which the second terminal is arranged in the same address space as the first terminal, a local address of the first terminal is used as the sender address, and in the other cases a detected global address of the first terminal. The use of such a terminal avoids the disadvantages of using STUN servers and other methods that generally use global addresses for communication links by providing a case-by-case decision to use global or local addresses. In this case, the terminal and thus also the method can be used in networks in which the participating terminals are not arranged in the same subnetwork or the same domain.

Advantageous embodiments of the method are specified in the dependent claims. The features and advantages described for the method are mutatis mutandis to apply to the terminal according to the invention, and vice versa.

Connections to terminals outside the local address space of the first terminal can be established easily and with conventional network technology, eg simple NAT instances, if, in or before the third step, at least in those cases where the result of the check is negative, that the first global address assigned by accessing a STUN server is determined.

In many cases it is sufficient if the number of hops during the transmission of the test data packet to the second terminal is detected and evaluated for the check. For the check, the number of hops of a further test data packet to the STUN server is then advantageously determined and compared with the number of hops of the test data packet to the second terminal. With an identical number of hops, it can be concluded that the called terminal and the STUN server are located in the same address space, ie the public network. In these cases, it is often possible to dispense with further analyzes of the first-mentioned test data packet.

An optimized routing can be carried out if the check determines whether the second terminal and the STUN server are located in a data network with the same address space and, in the positive case, in the third step, the global address is used. A common use case is covered when the Internet is used as the public data network.

Embodiments of the method according to the invention are explained below with reference to the drawing. At the same time, they serve to explain exemplary embodiments of terminals according to the invention.

The single figure shows a schematic representation terminals in a local and in a public data network.

In the figure, terminals E1, E2, E3 are shown in the local area network LAN and the public data network WWW. The local data network LAN is a widely branched data network of a company in these embodiments. The public data network WWW is the Internet in this embodiment; Of course, other data networks LAN, WWW be used. The local data network LAN is linked via a router R to the public data network WWW.

To the terminals E1, E2, E3, the respectively assigned communication addresses (here: IP addresses) are shown. The IP address displayed at the router is the Internet address associated with the Internet-facing interface (not shown) of the router R; the router R can therefore be addressed via the IP address 246.154.17.3 from the public data network WWW. From the local data network LAN out the router R is also addressable; the associated IP address is not shown. The router R is equipped with a NAT instance ("NAT server"), which serves the address translation ("Network Address Translation") or the port conversion (PAT = Port Address Translation). Data packets which are routed from the terminals E1, E2 into the public data network WWW are received by the router R or the NAT instance with the "sender address" 246.154.17.3, ie the IP address of the NAT instance and of the router R , provided in their IP headers.

The local data network LAN, which is shown here for reasons of clarity only with the relevant network elements for this description, namely the terminals E1, E2 and the router R, is divided into different domains and sub-data networks, so that the terminals E1 and Although E2 belong to the same address space, there is no information in the terminals E1 and E2 as to which of the terminals E1, E2, E3 are arranged in the local area network LAN and which belong to another data network, for example the public data network WWW.

In addition to the terminal E3, an addressing server STUN (Simple Traversal of UDP messages over NAT), also called a STUN server, is arranged in the public data network.

The STUN server has among other things a function, the communication connections, mostly Internet telephone calls according to the SIP standard, allowed between terminals E1, E2 in a local area network and terminals E3 in a public data network. In this case, the STUN server acts as a "switching station" for the user data streams, wherein the data packets of the user data streams are received by the STUN server in each case from a transmitting terminal and forwarded to the receiving terminal. However, this function should not be used for the communication links in this embodiment, because for reasons of data security and resource optimization and not least to minimize the maturity of the data packets, the user data streams and the signaling messages exchanged directly between the terminals E1, E2 and E3 should be. The procedure described in RFC3489 (RFC = Request for Comment) should therefore not be used.

Another function of the STUN server used here is that terminals E1, E2, E3 can determine by means of a query message to the STUN server under which globally valid IP address of this particular terminal E1, E2, E3 can be reached. A corresponding query message of the terminal E1 would answer the addressing server STUN (STUN server) in the present embodiment with a response message, which includes the IP address 246.154.17.3 together with an associated IP port number. Namely, this is the address which is assigned to the NRT instance installed by the router R or the NRT instance installed in the router R as those "sender addresses" transmitted from the local area network LAN to components and instances of the global data network WWW. An identical query message of the terminal E3 would answer the addressing server STUN with the IP address 194.221.5.4, because data packets of the terminal E3 are not "redirected" by a NAT instance, so that the network interface of the terminal E3 associated IP -Adresse 194.221.5.4 per se a valid Internet address shown.

In the following, a first case example will be explained with reference to the figure, in which a real-time communication connection is to be established from the terminal E1 to the terminal E2. It is assumed that in the terminal E1 information about the communication address of the terminal E2, ie in this case the IP address 107.246.115.4, is present. If the IP address of the desired communication partner does not exist, such an address can be obtained by accessing a SIP proxy server, a directory server, a DNS server or the like. be learned; such a procedure corresponds to the state of the art. Since in the terminal E1 there is no information as to whether the terminal E2 or the IP address of the terminal E2 belong to the same address space, ie the same local data network LAN as the terminal E1, the terminal E1 now sends a test message or a Test data packet to the IP address of the terminal E2. The course of this test data packet or the test message is recorded; This is also called "tracing". In this case, by means of corresponding network diagnostic means which correspond to the state of the art, the passed network elements, in particular routers, are registered and the number of necessary "hops" of the test message is determined on their way from the terminal E1 to the terminal E2.

The analysis of the sent test data packet or its "path" shows that no "hop" was covered, so that no router was used. Thus it has been proved for the terminal E1 that the terminal E2 is arranged in the same (local) address space, whereby the "own" IP address of the terminal E1, namely the 107.246.124.3, not only in the header of the data packets sent to the terminal E2 (here in particular the SIP Invite message), but also in the "higher protocol layers" of the communication (here: SIP communication) can be used. In this case, cases may occur in which the number of "hops" is not equal to zero, although both affected terminals E1, E2 are in the same private, local data network LAN. In such cases, an analysis gives the traversed nodes for the test data packet Information about whether the address of the called terminal E2 belongs to the same private data network LAN. Such an analysis can also be used to determine whether the test data packet has been routed from the local data network LAN into a global data network WWW and from there back into the same local data network LAN. Even in such cases, a "direct communication" using only the locally valid IP addresses is possible and advantageous.

In the following, the case is considered that the terminal E1 establishes a communication connection to the "external" terminal E3. Deviating from the case shown in the figure, the terminal can also be arranged in a third, local data network "behind" another NAT instance. Here, too, the dispatch of a test data packet from the terminal E1 to the terminal E3 takes place, wherein an analysis of the course of the test data packet shows that the data packet has only passed through one "hop", namely the router R. Now sends the terminal E1 another data packet, namely a query message to determine the own "external" IP address to the addressing server STUN. The course of this second test message is also analyzed, and as a result a "hop" is also determined via the router R. Thus it has been proved for the terminal E1 that the addressing server STUN and the terminal E3 are located in the same data network WWW.

This analysis, like the analyzes described above, can be performed either by the terminal E1 itself or by an external entity. In particular, the use of a suitably equipped SNMP server (SNMP = Simple Network Management Protocol) offers. Such a service can not only analyze the history of data packets (test messages), but also often has detailed information about the topology of the "own" network, its domain structure and "own" address space, so that an analysis of the The test data packet passing through network elements (eg routers) directly information about it can give whether the achieved goal of the test data packet, namely the terminal E2, is an "external" terminal or not.

Based on the query message, the addressing server STUN sends to the terminal E1 a response message comprising the "externally visible" IP address and IP port number of the terminal E1; the IP address is identical to the "external" IP address of the router R, namely 246.154.17.3. Based on the knowledge that the called terminal E3 is located outside of its own address space, the terminal E1 now uses its "externally visible" IP address 246.154.17.3 in the higher protocol layers of the SIP protocol, in particular as "sender address", which originates from the terminal E3 is to be used for response messages and for the user E3 from the terminal E3 to the terminal E1 useful data stream. However, the IP headers of the data packets which are sent from the terminal E1 to the terminal E3, initially carry the locally valid IP address of the terminal E1 as the "sender address", namely 107.246.124.3. This "sender address" in the IP header is first replaced by the router R or the NAT instance of the router R by the "external" IP address 246.154.17.3.

Claims (7)

Method for establishing a packet-oriented communication connection from a first to a second terminal (E2, E3) in a data network (LAN, WWW),
wherein the data network (LAN, WWW) consists of a local data network (LAN, WWW) with local addresses of a local address space and an associated public data network (WWW) with global addresses,
wherein the first terminal (E1) is arranged in the local area network (LAN) and
wherein the first terminal (E1) is assigned a local address (107.246.124.3) for communication connections within the local data network (LAN) and a global address (246.154.17.3) for communication connections with terminals (E3) of the public data network (WWW),
characterized in that - In a first step by the first terminal (E1) a test data packet to the second terminal (E2, E3) is sent, wherein the route of the test data packet in the data network (LAN, WWW) is detected, - is checked in a second step based on the detected route, whether the first and the second terminal (E2, E3) are arranged in the same local address space, and in a third step, in the cases where the result of the check is positive, the local address (107.246.124.3) of the first terminal (E1) is used as the sender address for establishing the communication connection, and in the other cases the global address , Method according to claim 1,
characterized in that
in or before the third step, at least in those cases where the result of the check is negative, the global address (246.154.17.3) associated with the first terminal (E1) is determined by accessing a STUN server (STUN). Method according to one of the preceding claims,
characterized in that
the number of hops during the transmission of the test data packet to the second terminal (E2, E3) is detected and evaluated for the check. Method according to claim 3,
if dependent on claim 2,
characterized in that
for verification purposes, the number of hops of another test data packet to the STUN server (STUN) is determined and
is compared with the number of hops of the test data packet to the second terminal (E2, E3). Method according to claim 4,
characterized in that
the check determines whether the second terminal (E2, E3) and the STUN server (STUN) are located in a data network (LAN, WWW) with the same address space and in the positive case in the third step the global address (246.154.17.3 ) is used. Method according to one of the preceding claims,
characterized in that
as the public data network (WWW) the Internet is used. Terminal (E1) for establishing a packet-oriented communication connection in a data network (LAN, WWW),
marked by a device for sending a test data packet to a second terminal (E2, E3), Means for detecting the route passing through the test data packet in the data network (LAN, WWW), Means for evaluating the detected route, it being possible by means of this means to determine whether the second terminal (E2, E3) is arranged in the same address space as the first terminal (E1), Means for detecting a global address (246.154.17.3) associated with the first terminal (E1), and - A device for establishing the communication link to the second terminal (E2, E3), wherein this device is designed such that in the cases in which the second terminal (E2, E3) is arranged in the same address space as the first terminal, a local address (107.246.124.3) of the first terminal (E1) is used as sender address, and in the other cases, the detected global address (246.154.17.3) of the first terminal (E1).

Images